Executive brief
A vulnerability was identified in the Linux kernel's batman-adv mesh networking component. The issue involves how the system tracks network neighbors, potentially leading to a system crash or instability when certain network entries are cleaned up. This could affect the reliability of devices using mesh networking, such as specialized wireless routers or IoT devices.
Technical details
A vulnerability in the batman-adv component of the Linux kernel arises from the BAT IV algorithm caching unowned originator pointers in neigh_node structures. These pointers are derived from temporary lookups and are not properly reference-counted by the neigh_node. Consequently, after purge handling runs, these pointers may refer to freed memory, leading to a use-after-free condition. The fix involves removing the auxiliary originator pointer from the BAT IV neighbor state and instead resolving the originator data from the stored neighbor address only when needed, ensuring proper reference management. This issue primarily affects systems utilizing the B.A.T.M.A.N. Advanced meshing protocol.
Affected products
- Linux Linux kernel All versions including batman-adv BAT IV
Timeline
- 2026-05-03: other: Patch authored
- 2026-05-28: disclosed: CVE published
References
- https://git.kernel.org/stable/c/09dc0d1a12222ffca6481916eab3cfea477b9620
- https://git.kernel.org/stable/c/67bceeb22207f1f5a402973a3a0809e5f2698f38
- https://git.kernel.org/stable/c/6e20700f8c524ac379ba8274ff5d453023b7c006
- https://git.kernel.org/stable/c/aafcbaf1159ea224528ca4075d0ba8c10ef374af
- https://git.kernel.org/stable/c/f03e8583532941b07761c5429de7d50766fa3110